System and apparatus for secure password recovery and identity verification

ABSTRACT

A secure method for resetting the password for an account is disclosed. During the setup of the account, the user can provide the service provider with a media file, and when the user asks the service provider to reset the password for the account, the user will be prompted with several media files. The user can be asked to identify the media file that the user provided to the service provider at the time of the setup of the account. If the user properly identifies the media file, the password will be reset.

BACKGROUND

With the advent of the Internet and advancements in computer systems,online accounts have become an important part of our daily lives. Onlineaccounts facilitate interactions between service providers and users (orcustomers) from anywhere in the world at any time. Because of thesefeatures, online accounts offer an unsurpassed level of convenience forthe users. However, as online accounts have become popular, computersystems are facing new challenges that did not exist in the pre-Internetera. For example, in the pre-Internet era, physical access to computersystems was necessary for any unauthorized access to the networkssupported by the systems. Because maintaining the security of a hostingfacility was relatively easy, these systems and networks enjoyed a highlevel of security and isolation against unauthorized access.

However, the Internet has made it possible to access these systems fromalmost anywhere in the world. As a result, physical access to computersystems are not necessary anymore to manipulate or exploit the contentof these systems. Therefore, new groups of sophisticated criminals, manyof whom live outside the jurisdiction of the law enforcement of thiscountry, have become active. Oftentimes, these criminals orchestrateattacks on the computer networks of major companies and steal valuableinformation. In many cases, the attackers gain access to the networks byobtaining the usernames and passwords of unsuspecting users. Thus,maintaining the security of online accounts has become an utmostimportant task for administrators of computer networks.

SUMMARY

In many cases, an online account has a username and password to restrictaccess to the account. Generally, this protection scheme provides aneffective barrier against unauthorized access to an online account.However, remembering the usernames and passwords for the accounts hasbecome a daunting task. These days an ever-expanding number of serviceproviders allow their customers to receive services through onlineaccounts. In practice, this means that an average user of onlineservices now has to remember an ever-increasing number of usernames andpasswords. To make the matters worse, many of the service providersrequire the users to create accounts that follow certain rules andguidelines. For example, some service provides require the users toinclude numbers in the username or password. Also, requiring the usersto include upper case characters as well symbols in passwords has becomevery common. These rules and guidelines require the users to createusernames and passwords that are not personal to and memorable for theuser. While storing the usernames and passwords can prevent users fromforgetting them, this can reduce the security of the username andpassword. In other words, writing the password on a piece of paper orstoring it in a text file on an electronic device can reduce thesecurity of the password, and it can make it more susceptible to beingcompromised. In some cases, the users are prohibited by law from writingtheir username or password. Given the increasing number of usernames andpasswords that the users have to remember, and that the combinationsused in the usernames and passwords are not easy to remember for users,it is very likely that users forget their usernames or passwords. As aresult, resetting the username or password has become a very commonproblem for system administrators of computer networks.

Various techniques have been proposed for resetting the password (orusername) for an online account. Some service providers allow users toreset their passwords by calling a customer service number. In theseorganizations, in order for the user to reset the user's password, theuser will have to call the customer service center and reset thepassword over the phone. However, before resetting the password, theuser has to establish the user's identity by disclosing several piecesof personal information. If the service representative ascertains thatthe user is the true owner of the account, the representative can resetthe password for the account. This is generally done by either allowingthe user to enter a temporary pin over the phone or emailing a temporarypassword to the user. However, there are a few drawbacks associated withthis method of resetting passwords. First, establishing the user'sidentity can be a problem. For example, in smaller organizations thathave only a few users, the administrator generally knows the users, andthe administrator can ascertain the true identity of the caller over thephone, e.g., voice recognition. However, for larger organizations withmany users, the call representative does not know the caller, andtherefore, an imposter can call the call center and reset the password.Second, these call centers are resource intensive and the number ofincoming calls is unpredictable. As a result, the service provider mustalways have a team of representatives available to address these calls,which can be expensive for the service provider.

Some service providers allow users to reset the passwords by mailing atemporary password to the users. In other words, in response to arequest by a user for resetting the password, the service provider mailsa letter to the user including the user's new temporary password.Subsequently, the user can enter the temporary password into the systemand reset the password. However, this method of resetting a password hasits drawbacks. Specifically, in this system, the resetting process isnot instantaneous, and the user would have to wait for a letter to bemailed and delivered before the user can reset the password. Moreover,usually the user's password is sent to the user's mailing address onfile. However, if the user is travelling or has changed address, theuser will have to take additional steps to reset the password, which canmake the process very inconvenient for the user.

Some service providers ask users predetermined questions over theInternet, and if the user responds to these questions correctly, theservice provider resets the password. For example, while setting up anonline account, the service provider asks the users severalpredetermined questions such as the user's mother's maiden name. Inorder for the user to set up the account, the user has to answer thesequestions and the service provider stores the answers. Later, if theuser expresses a desire to reset the password of the user's account, theuser will be prompted with some or all of the same questions. Uponproviding the pre-stored answer, the account will be reset. This methodof resetting account passwords is helpful because it instantaneouslyresets the user's password. Service providers also prefer this methodbecause the resetting can be done automatically, i.e., process requiresminimal human input on the part of the service provider. However, thereare a few drawbacks to this method. First, this method is not verysecure because the answers to many of the predetermined questions areavailable online. For example, an unauthorized hacker might be able toguess some of these answers by searching the web (or the dark web) andmight attempt to reset the password for the user. Moreover, withcreation of black markets for selling personal information of users,hackers might capitalize on this information to guess a user's answer tothese questions. Second, the users might forget the answers to thequestions or the users' answers to the questions might change over time.For example, a user's answer to a question about the user's favoritemovie might change over time.

Some service providers allow the users to customize the reset questionsso that the questions are not predetermined. For example, a user candraft a security reset question and provide the answer to the questionto the service provider. This method is helpful because the moreparticularized the question is the less likely the answer would beavailable to a hacker. However, in this day and age, all of serviceproviders are susceptible to online attacks and hacking attempts, and ifthe service provider is hacked, the answer to these questions can becompromised. Moreover, the more particularized the question and theanswer to the question are, the more likely that the user would forgetthem. Therefore, if the user attempts to recover the user's passwordafter several years, it is very likely that the user would not rememberthe answer to the proposed question.

Therefore, it is an object of the present disclosure to propose amethod, apparatus and system for overcoming these shortcomings.

Many studies suggest that human beings tend to remember a visual cuebetter than a word or phrase because our visual memory is stronger thanour verbal memory. For example, a person can easily remember a photo ofher teacher, while the person might forget the name of the teacher aftera few years. Similarly, some people tend to remember a video recordingor a vocal recording better than a word or phrase. Therefore, accordingto an aspect of the present disclosure, during the setup of an account(which can be online or offline account), the user provides the serviceprovider with a media file, and when the service provider is asked toreset the password for the account, the user will be asked a questionand prompted with several media files to identify the media file thatthe user provided to the service provider. A media file can be a digitalphoto, video clip, music segment, a GIF, a voice recording, etc. Theuser is more likely to remember the media file and selecting the mediafile among other media files would be easier for the user. At the sametime, it is unlikely for a hacker to have seen the media file or to havediscovered the relationship between the user and the media file,particularly if the hacker does not know the user. Therefore, thismethod of resetting password for an account is more secure and lessonerous for the user.

According to another aspect of the present disclosure, the system isprovided with an artificial intelligence which enables the system tosearch and retrieve several media files related or similar to the mediafile uploaded by the user. When the user requests to reset the password,the system displays the uploaded media file as well as the related mediafiles. Mixing the uploaded media file with several other media fileswould enhance the security of the system. However, the system is notrequired to display the uploaded media file in every instance. In someembodiments, the system could display only the related media files andask the user if the user recognizes any of the media files.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows an example flow process for signing up for an onlineaccount.

FIG. 2 shows a sign in page of a user interface of an application for asocial media.

FIG. 3 shows an identification page in the user interface of theapplication for the social media.

FIG. 4 shows an example password reset page of the user interface of asocial media application.

FIG. 5 shows an example flow process for resetting a user's password.

FIG. 6 illustrates exemplary hardware components for a server.

DETAILED DESCRIPTION The Sign-Up Process

In an example embodiment of the present disclosure, a user can sign upfor an online account with a service provider. A user can decide to openup an online account for a variety of reasons. For example, a user mightdecide to sign up for an online account because the user intends toreview the user's information (e.g., purchase history) on the website ofa service provider. As another example, the user might decide to sign upfor an online account because the user desires to conduct onlinetransactions on the service provider's website. In some embodiments, theuser can sign up for an account that is not an online account. Forexample, the user can sign up for an account on the user's localdesktop. Another example of an account can be a device that locks if itis provided with an incorrect password, e.g., an electronic watch, acellphone, augmented reality glasses, etc.

In some embodiments, the service provider can require the user to visitthe service provider's website to sign up for an online account. Thewebsite can have a link, a button, a web page or other surfing indiciawhich can direct the user to enter the user's information. Thisinformation, for example, can include the user's name, email address,username, password, reset phrase and a reset media. This list isillustrative and is not meant to be exhaustive. In some embodiments, thesigning up process can take place using on an application (or app) ofthe service provider. The user can visit the service provider's websiteand download the service provider's application. The user can run theservice provider's application on a device of the user. The device canbe a smartphone, a cell phone, a laptop, a desktop, a notebook, atablet, a wearable device, etc.

Once the user provides the information requested on the website (or app)of the service provider, the user can transmit the information to theservice provider. For example, the user's device can have a userinterface which displays the website of the service provider. This userinterface can include a link, button or other indicia for the user torequest transmission of the information to the service provider.

Upon receiving this information at a server of the service provider, theservice provider can decide to open up the online account for the user.This decision can be based on, e.g., whether the user's informationexists in the system. This decision can also be based on whether theuser's username exists in the system or whether the password meets theminimum requirements indicated on the service provider's website.

Once the sign-up process is completed, e.g., the server of the serviceprovider approves the username and password of the user, the user can benotified that an account has been created. This notification can happenon the user interface of the user's device, or it can happen via anemail or other mode of communication. Subsequently, the user can loginto the online account of the user and visit the user' information orrequest services.

FIG. 1 shows an example flow process for signing up for an onlineaccount. In the example embodiment of FIG. 1 , the user can be an onlinecustomer for a retail store, and by opening an online account, thecustomer intends to review his purchase history. The online customer canvisit the retailer's website and request opening of an online accountby, for example, clicking on a button for new users. In step 101, aserver of the service provider receives the customer's request forsigning up for an online account. Subsequently, in step 102, the servertransmits to the customer a communication including various questions orredirects the customer to another web page through which the customercan enter the customer's information to open an online account. Thus, anew web page can be displayed on the user interface of the customer'sdevice. The web page can include a form which has several questions. Thequestions can ask the user to designate a username and password for theaccount. The questions can also ask for personal information from theuser, e.g., email address, telephone number, checking account umber,etc.

The web page can also include a button or link, which the customer canpress upon disclosing all the information requested on the web page.Upon pressing the button, the customer's device transmits the user'sinformation to the bank's server, and in step 103, the server receivesthe customer's information. Subsequently, in step 104, the serverdetermines whether to open an online account for the bank customer. Forexample, if the provided username does not exist in the system, theserver can determine to open an account, and in step 105, the servertransmits a confirmation message to the customer that an online accounthas been created for the user. On the other hand, if the username existsin the system, the server might prompt the customer to choose adifferent username, and the server returns to step 102. Similarly, ifthe selected password does not meet the minimum requirement for apassword, the user might be prompted to select a different password, andthe server would be returned to step 102.

In some example embodiments, the user is asked to identify on the samepage a reset phrase, a username and password. In other embodiments, theuser might be prompted after the username and password was selected bythe user to identify a reset phrase. Other combinations are alsopossible. For example, in some embodiments, the user is not required toidentify a reset phrase.

The reset phrase can be at least one character, symbol, word, or a term(or even a media file) which can be displayed to the user when the userrequests a resetting of the user's password. The user can type thisphrase in any language recognized by a computer. In some embodiments,the reset phrase is a photo, an image, or a short video clip. Some userscan use the reset phrase to remind themselves of the reset media. Forexample, the online customer can use the following phrase as the resetphrase: “Your dog Charlie!” Similarly, the customer can select a photoof “Charlie” to be uploaded into the server of the retailer as thecustomer's uploaded media file. Once the customer requests the retailerto reset the password for the customer's online account, the retailer'sserver can transmit the phrase “Your dog Charlie!” and a few photos tothe customer's device. This phrase can remind the customer that thecustomer uploaded a photo of “Charlie” in the system, and thus, thecustomer would select the photo of “Charlie” in the lineup of thephotos.

In some embodiments, at the sign-up stage, the user can select severalmedia files to be uploaded into the computer system of the retailer. Themedia files can be, for example, photos, video files, sound recordings,text files, etc. The media files can be of the same type or of differenttypes. For example, the user can upload only photos (which are mediafiles of the same type) or can upload a mix of photos and video clips(which are media files of different types). Although photos and mediafiles were used as examples of files to be uploaded, the user is notlimited to uploading only media files into the computer system. A usercan upload other files as the reset file as well, e.g., an encryptedtext, an executable file, etc.

In an example embodiment, a user can create a user profile. The userprofile can be created when the user is signing up for the account orafter the user signs up for the account. The user profile can includevarious information about the user. For example, a user profile caninclude a date of birth of a user, an address, a photo of the user, etc.The user profile can also include the user's username, password, resetphrase and reset media file. In an example embodiment, it is possible toinclude other information in a user profile as well. For example, theservice provider can add information to the user profile of the user.This information can be an interaction history of a user with theservice provider, an analysis of a user's behavioral characteristics, aregression analysis and other analysis pertaining to the user's traitsand habits.

Although the example embodiments of this disclosure depict variousembodiments pertaining to an online account, this disclosure is notlimited to online accounts, and one of ordinary skill in the artrecognizes other types of accounts or setups which can implement theteachings of this disclosure, e.g., voicemail account, desktop account,virtual reality account, etc.

Updating the Security Questions

In an example embodiment, a user can upload, modify, update or deleteuser information after signing up for an account. The user can alsomodify, update or delete the user's profile or the information providedin the user's profile. Accordingly, a user can provide information itemssuch as a reset phrase or a reset media file after the user opens up theaccount. Additionally, the user can change these information items afterthe user opens up the account.

For example, once a user signs into the user's account, there can be alink to the user's profile. By clicking on the user's profile, the userinterface of the user's computer displays some or all of the informationstored in the user's profile. This information can be the user'susername, reset phrase, reset media, user's address, etc. Otherinformation can also be displayed to the user on the profile page. Therecan be a link next to each one of the information fields displayed onthe user's profile. For example, there can be a link next to the user'sreset phrase, and by clicking on the link, the user can modify or updatethe user's reset phrase on file with the service provider. In someembodiments, the user can click on an information field to update ormodify the information displayed in the information field. For example,the user can click on the information field including the user's resetphrase to modify the user's reset phrase.

In some embodiments, the user can update, modify or delete the user'sreset media file. For example, the website of the service provider canbe configured to display the user's profile in response to a user'srequest for visiting the user's profile. Once on the profile page, theuser can request changing the reset media file (or adding a media fileto the profile). In response to this request, the user can be promptedto identify a new media file. The user can select the new media file andpress a button to upload the media file into the system.

The Reset Process

In an example embodiment, a user with an online account decides to resetthe user's password for the online account. This might happen when, forexample, the user forgets the user's password. The user can submit apassword reset request in various ways. For example, the user can visitthe service provider's website and click on a link, button or otherindicia to indicate that the user needs to reset the password (i.e.,reset link). As another example, the user can call or email the serviceprovider.

In some embodiments, the user has to provide certain information aboutthe user when or after the user submits the password reset request. Forexample, a service provider can ask for the user's username when orafter the user clicks on the reset link. In these embodiments, on theweb page including the reset link, there can be a field for disclosingthe user's username, and the link might not be activatable unless theuser enters the user's username. In other embodiments, the user'susername can be asked from the user after the user clicks on the resetlink. Other means of obtaining the user's username are also possible.

In yet some other embodiments, the user's username is not provided tothe service provider when the user requests a password reset. Forexample, instead of a username, the user can be asked to provide theuser's email address or other personal information (e.g., date of birth,address, etc.) to the service provider. In some embodiments, a server ofthe service provider can recognize the user by analyzing the passwordreset request received at the server. For example, the request caninclude a piece of information about the user or the user's computer,e.g., IP address, network address, geolocation, cookies, devicefingerprint, etc.

FIG. 2 shows a sign in page 201 of a user interface 200 of anapplication for a social media. In this example embodiment, the sign inpage 201 can ask for the user's username 202 and password 203. The usercan enter the user's username and password in the fields 204 and 205.The sign in page 201 can also have a button 206 for signing in and aforgot password button 207 for resetting the user's password. The usercan press the forgot password button 207 to initiate a reset of theuser's password. Upon pressing this button, a request can be submittedto a server of the service provider. This request can be submitted bythe user's computer or device which displays the user interface 200. Inresponse, the server can direct the user to another page for identifyingthe user. However, in some embodiments, the user does not need to bedirected to another page for identification and the reset can take placeon the same page. FIG. 3 shows an identification page 301 in the userinterface 200 of the application for the social media. In this exampleembodiment, the identification page 301 can ask the user for the user'susername. The user can enter a username 302 in the field 304 of theidentification page 301 and press the reset password button 303.

In some embodiments, a server of the service provider can receive theuser's request for resetting the user's password, e.g., when the resetpassword button 303 is pressed. The request can include the user'susername or other information which can facilitate the identification ofthe user, e.g., email address. Using this information, the server canidentify the user and determine which user account or online accountneeds to be reset. This identification can be done, for example, by theserver looking up a data structure in a database. In some embodiments,the server can look up the user's profile to determine which questionsto ask the user to reset the password. The user's profile can include,for example, the user's personal information such as name and address,username, password (or encrypted password), reset phrase, any photos ormedia files that the user uploaded for resetting the user's password,etc. The user's profile can be stored in a database of the server whichreceived the reset request.

Once the server looks up the user's profile (or other data structure inthe database), the server can determine which information to present tothe user and which information to request from the user to reset thepassword. For example, the server can display a reset phrase and severalmedia files to the user and the user can select the media file that theuser uploaded into the server when the user created the user's profile(or account). This media file can be called the uploaded media file.

Subsequently, the server can transmit certain information to the user.For example, the server can direct the user to a password reset pagewhich can include the reset phrase and several media files. Also, thepassword reset page can include various questions. In some embodiments,the user is automatically directed to the password reset page once theuser clicks on the link or button on the identification page. In someembodiments, in order for the user to be directed to the password resetpage, the user can receive an email. For example, upon clicking on thelink or button on the identification page, the user can receive an emailincluding a link or button for directing the user to the password resetpage. In some embodiments, an Internet address can be mailed in a letterto the user (instead of an email).

Once the user is directed to the password reset page, the user can beprompted with one or more media files. The user can also be promptedwith the reset phrase. The user can also be prompted with one or morequestions. The password reset page can also include any combination ofthese items or any other items.

FIG. 4 shows an example password reset page 401 of the user interface200 of a social media application. In this example embodiment, the useruploaded the photo 403 b as the user's media file and chose “Charlie” asthe user's reset phrase. The service provider's server can transmitmedia files 403 to the user's device. The user's device can display thepassword reset page 401 on the user's device. The password reset page401 can display the user's reset phrase 402 and several media files 403.Displaying the user's reset phrase is optional. The media files 403 canbe chosen by the artificial intelligence of the server. The artificialintelligence can choose the media files 403 every time the user requeststo reset the password. Alternatively, the artificial intelligence of theserver can choose the media files for a predetermined period of time,i.e., it transmits the same files to the user during this period of timeno matter how many times asked by the user to reset the password. Theuser interface 200 is configured to receive a user selection of one ormore of the media files displayed on the password reset page.

In this example embodiment, media files 403 include the user's uploadedmedia file (at the time the online account was setup), i.e., 403 b.However, there is no requirement to display the user's uploaded mediafile every time. As such, in some embodiments, the server can transmitseveral media files to be displayed on the password reset page, andoccasionally none of these media files is the media file that the useruploaded into the server of the service provider when the user opened upthe account. In these embodiments, on the password reset page, the usercan be prompted to select the uploaded media file. However, when themedia file is not displayed on the user interface, the user cannotselect any of the displayed media files. In some embodiments, there is aprocess for the user to express that the media file is not displayed onthe user interface. For example, the server is configured to transmit tothe user's device a media file indicating that the user's media file isnot displayed, e.g., media file 403 e in FIG. 4 . Selection of thismedia file by the user can indicate that the user does not see theuser's uploaded media file. As another example, the user can simplypress a button, e.g., reset password button 404, without selection ofany media files to indicate that the uploaded media file is notdisplayed. In the embodiments which do not display the uploaded mediafile, the safety of the system can be enhanced because the server doesnot have to display the user's chosen media file all the time.Therefore, a potential hacker would not be able to discover a range ofmedia files for the user's uploaded media file.

In some other embodiments, the user can upload multiple media files whenthe user sets up the account (or profile), or when the user modifies orupdates the user's reset media file(s). In these embodiments, the severcan be configured to transmit some, all or none of these uploaded mediafiles to the user's device to display them on the password reset page.The password reset page can require the user to select all or some ofthe displayed media files which were uploaded by the user, and thus, theuser can select multiple media files. In these embodiments, the uploadedmedia file which is displayed can change or rotate, and thus, thesecurity of the system can be enhanced.

Regardless of how many media files the user uploads when the user setsup the account (or modifies the account), the user interface can allowthe user to select multiple media files. Allowing users to selectmultiple media files on the password reset page can enhance the securityof the system because a potential hacker would not be able to guess howmany media files the user has uploaded into the system.

Once the media files are displayed to the user on the password resetpage, the user can select, choose or identify one or more of the mediafiles and the user's device can transmit the user's selection (or anidentification of the user's selection, e.g., file name, size,extension, etc.) to the server. In some embodiments, the device canautomatically transmit the selection to the server once the user, forexample, clicks or taps on a media file. In some other embodiments, thedevice can transmit the selection after the user initiates thetransmission by, e.g., pressing a button. In FIG. 4 , the user canselect any one or ones of the media files 403 by tapping on the mediafile. For example, the user can tap on media file 403 b. The user canalso select multiple media files by, for example, tapping on media files403 b and 403 c. The transmission of the selection by the user to theserver can occur after the user presses the reset password button 404.These methods for selecting media files are not exhaustive and one ofordinary skill in the art recognizes that several other techniques areknown for choosing, selecting or identifying the uploaded media file onthe password reset page (or elsewhere).

Once the user's selection is transmitted to the server, the server candetermine whether the user selected the correct media files, i.e.,uploaded media files, and decide whether to reset the password.Specifically, if the user identifies the correct media file (or files),the user's password can be reset. Otherwise, the user's account can belocked if the user has exceeded a threshold number of attempts inresetting the password. In some embodiments, the user's account cannotbe locked even if the user has had many failed attempts to reset thepassword.

There are several techniques for resetting the user's password. Forexample, the server can issue a temporary password for the user,transmit it to the user's device, and the user's device can display thetemporary password to the user on the device's user interface. Asanother example, a temporary password can be emailed or mailed to theuser. Once in possession of the temporary password, the user can visitthe website of the service provider to access the user's account. Insome embodiments, upon entering the temporary password on the website,the user will be prompted to choose a new password.

In some embodiments, upon selecting the correct media file, the servercan reset the password by asking the user to select a new password. Forexample, the server can direct the user to a web page which includes afield for typing the user's new password. In some other embodiments,instead of a temporary password, the server can simply disclose theuser's password to the user, e.g., on the user's device, via email or bymail.

FIG. 5 shows an example flow process for resetting a user's password. Inthis example embodiment, when opening the account, the user uploaded avideo clip as the user's reset media file. In step 501, the user selectsa link on the service provider's website to request a reset of theuser's password. In step 502, the service provider requests the user toidentify herself by providing the user's username. Once the serverreceives the user's username, the server looks up the user in a databaseto identify the user's uploaded media file, e.g., video clip. Then, instep 503, the server can decide which media files to select fortransmission to the user. For example, the server can select relatedmedia files and the user's uploaded media file. The related media filesand the uploaded media file can include the same type of media files,e.g., all can be video clips, or they can be of different types, e.g., amix of voice recordings and video clips. The selected media files caninclude the video clip which the user uploaded as the reset media file,or the transmitted media files can exclude this video clip. The servercan decide which media files to transfer to the user. Upon determiningwhich media files to transmit to the user, in step 504, the server cantransmit the selected media files, e.g., video clips, to the device ofthe user. Once the media files are displayed on the user interface ofthe device of the user, the user can be prompted to identify theuploaded media file. Then, in step 505, the user can select one of thetransmitted media files, and the user's device transmits this selection(e.g., an identifier of the selected media file) to the server.

In step 506, the server determines whether the user has correctlyidentified the uploaded media file or files, and thus, the serverdetermines whether to reset the user's password. If the user hasidentified the correct media file, e.g., video clip, in step 507, theserver resets the user's password. In some embodiments, if the user hasmade an incorrect selection more than a threshold number of times, i.e.,the user has had a few failed attempts to reset the password, the servercan lock the user's account to prevent any resetting of the user'spassword. Thus, in step 508, the sever can determine whether the userhas exceeded the allowed number of attempts for resetting the password.If the user has not exceeded the allowed number of attempts, the serverreturns the user to step 505 to select a media file again. If the userhas exceeded the allowed number of attempts, in step 509, the serverlocks the user's account. The user might have to contact or visit theservice provider to unlock the account.

The Artificial Intelligence

When a user requests a password reset, the server can transmit to theuser several media files. The media files can include an uploaded mediafile (which was designated as the reset media file) and several relatedmedia files. The server can select the related media files. In someembodiments, the selection can be based on a media file searchalgorithm. For example, there can be a database on the sever whichstores various media files. The search algorithm can search the mediafiles, e.g., photos, videos, and sound recordings, stored on thisdatabase. The search algorithm can include a criteria for performing thesearch. The search criteria can be similarity (within a tolerance range)between a media file and the uploaded media file. For example, a photocan be selected if the photo is similar to a reset photo uploaded by theuser. Also, a sound recording can be selected if it is similar to anuploaded sound recording. The search algorithms are not limited to itemsstored on a database, and a server can search for related media files onnetworks such as the Internet. In an example embodiment, the databasecan include the uploaded media files of all the users, and at least someof the related media files are other user's uploaded media files. Inanother example embedment, there can be an overlap between the relatedmedia files of various users. For example, the server can select atleast one of the related media files of one user for another user.

In an example, the uploaded media file can be a photograph of a humanface and the related media files can be several photographs of humanfaces because the search algorithm determines that these photographs aresimilar within a tolerance range to the uploaded photo. In anotherexample embodiment, the user can upload a photograph of a dog and therelated media files can be several photographs of dogs. Again, thesearch algorithm can determine that these photographs are similar. Inyet another example embodiment, the uploaded media file can be a countrymusic track and the search algorithm can be configured to select severalcountry music tracks as the related media files. In yet another exampleembodiment, the uploaded media file be a video clip of a dog playing ina field. The search algorithm is configured to select several videoclips including dogs playing in fields. In one embodiment, the uploadedmedia file can be a video of waves, and the search algorithm isconfigured to select several video of waves.

In an example embodiment, there can be several uploaded media files andthe server can select the related media files based on the similarity ofthe media files to any of the uploaded media files. For example, if theuser uploads two photographs into the server, the server can search forphotographs which are similar to either one or both of the uploadedphotographs. In an example embodiment, the user can upload differenttypes of media files into the server. For example, the user can upload aphoto and a video file into the server. In this case, the related mediafiles can be similar to either the photo or the video file. In otherwords, the related media file can be similar to either one of the mediafiles.

There can be several algorithms for selecting a related media file. Inan example embodiment, there can be several predetermined categories ofmedia files. The server can disclose these categories of media files tothe user and the user can be asked (or the user can choose) to upload amedia file which would belong to one of these categories. For example,the sever can include a category for cats, and the server can ask theuser (or the user can choose) to upload a photo of a cat. In theseembodiments, the related media files can be selected based on thecategory of an uploaded media file. For example, all the related mediafiles can be selected from the same category as the uploaded media file.

In an example embodiment, some of the media files stored on the server'sdatabase can be tagged with words. Also, the server can be configured totag the uploaded media file with at least one word. The tagging can bedone manually or the sever can automatically tag the media files. Forexample, the server can include a face recognition module or an objectrecognition module for tagging the uploaded media file and/or the mediafiles stored in the database. The object recognition module can beconfigured to ascertain various objects included in a media file andassociate words with them. As another example, the object recognitionmodule can be configured to perform an image-to-image matching, e.g., anobject in the image can be matched with a known image of a known object.Once the uploaded media file is tagged, the server can search forrelated media files based on the tag of the uploaded media file. Forexample, if the uploaded media file is tagged with the word “table”(i.e., the object recognition algorithm discovered a table in thephoto), the server can look for media files which were also tagged withthe word “table.” This search can produce media files of the same type,e.g., all photos that include tables, or media files of different types,e.g., videos and photos that include tables. Ultimately, the server cantransmit the related media files and the uploaded media file to theuser's device, which can display them on a password reset page. Becausethe media files are all similar, a hacker is less likely to guess theuploaded media file base on the information available on the Internet.

There are several techniques for implementing the object recognitionmodule. In an example embodiment, a model can be trained from scratch,i.e., a very large labeled dataset can be gathered, and a networkarchitecture learns the features of the objects included in the dataset.In another example embodiment, a pre-trained deep learning model can beused. In this technique, one starts with a pre-trained model and feedsin new data containing previously unknown classes of objects. Theprocess involves fine-tuning the pre-trained model. In yet anotherexample embodiment, template matching can be used. This technique uses asmall image, or template, to find matching regions in a larger image. Inyet another example embodiment, image segmentation and blob analysis canbe used. This technique uses simple object properties, such as size,color, or shape to recognize objects.

Some embodiments of object recognition module can use machine learning.For example, a collection of images (or video files) can be gathered,and one can select the relevant features in each image. A featureextraction algorithm might extract edge or corner features that can beused to differentiate between classes in the data. These features areadded to a machine learning model, which will separate these featuresinto their distinct categories, and then use this information whenanalyzing and classifying new objects.

In an example embodiment, a photo search algorithm can be used forselecting a related media. For example, the server can include adatabase storing many photos. The server can use a photo searchalgorithm to find photos that are similar to the uploaded photo. Forexample, the photo search algorithm can use scale-invariant featuretransform (“SIFT”), which is a technique for detecting feature points inan image. SIFT can find distinctive keypoints that are invariant tolocation, scale and rotation, and robust to affine transformations(changes in scale, rotation, shear, and position) and changes inillumination. Using SIFT, the server can find photos that includefeatures points that are similar to the uploaded photo. In anotherexample, the photo search algorithm can use the maximally stableextremal regions (MSER) algorithm. The MSER algorithm can be used inimage registration and region matching. Using the MSER algorithm, theserver can find photos that include features points that are similar tothe uploaded photo.

In an example embodiment, a sound recording search algorithm can be usedfor selecting a related media. The sound recording search algorithm canuse an acoustic fingerprint, which is a condensed digital summary, or afingerprint, deterministically generated from an audio signal. Anacoustic fingerprint can be used to identify an audio sample or quicklylocate similar items in an audio database. A Fast Fourier Transform canbe used to implement acoustic fingerprinting.

These algorithms, e.g., MSER and acoustic fingerprint, can also be usedfor video files. In the case of a video file, the video file can bebroken into several frames, each frame including an image. The sever canperform an analysis between the frames of the video file and an uploadedimage or uploaded video. Using this analysis, if the sever determinesthat the video file is similar to the uploaded file, the sever candecide that the video file is a related video file. The sever can alsoperform an analysis of the sound recording of a video file to determinewhether it is similar to an uploaded media file which includes a soundrecording.

The search algorithm can include a criteria for performing the search.The search criteria can be similarity (within a tolerance range) of amedia file to the uploaded media file. The tolerance range can determinehow similar the related media files are to the uploaded media file. Inother words, a low tolerance range can indicate that the related mediafiles are very similar to the uploaded media file and a high tolerancerange can indicate that the related media files are not very similar tothe uploaded media file.

The tolerance range can vary based on various factors, e.g., howfrequently the user logs into the system. For example, for a user whoinfrequently logs in, the server can allow a higher threshold oftolerance because similar images can confuse the user. On the otherhand, for a user who frequently logs into the system, the server canallow a lower threshold of tolerance because the user probably has afresh memory of his uploaded media file.

Technical Implementation of the Sever

FIG. 6 illustrates exemplary hardware components for a system andapparatus for a computer or a server to reset a user's password. Acomputer system 600, or other computer systems similarly configured, mayinclude and execute one or more subsystem components to performfunctions described herein, including the steps of various flowprocesses described above. Likewise, a mobile device, a cell phone, asmartphone, a laptop, a desktop, a notebook, a tablet, a wearabledevice, a server, etc., which includes some of the same components ofthe computer system 600, may run an application (or software) andperform the steps and functionalities described above. Computer system600 may connect to a network 614, e.g., Internet, or other network, toreceive inquires, obtain data, and transmit information and incentivesas described above.

The computer system 600 typically includes a memory 602, a secondarystorage device 604, and a processor 606. The computer system 600 mayalso include a plurality of processors 606 and be configured as aplurality of, e.g., bladed servers, or other known serverconfigurations. The computer system 600 may also include a networkconnection device 608, a display device 610, and an input device 612.

The memory 602 may include RAM or similar types of memory, and it maystore one or more applications for execution by processor 606. Secondarystorage device 604 may include a hard disk drive, floppy disk drive,CD-ROM drive, or other types of non-volatile data storage. Processor 606executes the application(s), such as those described herein, which arestored in memory 602 or secondary storage 604, or received from theInternet or other network 614. The processing by processor 606 may beimplemented in software, such as software modules, for execution bycomputers or other machines. These applications preferably includeinstructions executable to perform the system and subsystem componentfunctions and methods described above and illustrated in the FIGS.herein. The applications preferably provide graphical user interfaces(GUIs) through which users may view and interact with subsystemcomponents.

The computer system 600 may store one or more database structures in thesecondary storage 604, for example, for storing and maintaining theinformation necessary to perform the above-described functions.Alternatively, such information may be in storage devices separate fromthese components.

Also, as noted, processor 606 may execute one or more softwareapplications to provide the functions described in this specification,specifically to execute and perform the steps and functions in theprocess flows described above. Such processes may be implemented insoftware, such as software modules, for execution by computers or othermachines. The GUIs may be formatted, for example, as web pages inHyperText Markup Language (HTML), Extensible Markup Language (XML) or inany other suitable form for presentation on a display device dependingupon applications used by users to interact with the computer system600.

The input device 612 may include any device for entering informationinto the computer system 600, such as a touch-screen, keyboard, mouse,cursor-control device, microphone, digital camera, video recorder orcamcorder. The input and output device 612 may be used to enterinformation into GUIs during performance of the methods described above.The display device 610 may include any type of device for presentingvisual information such as, for example, a computer monitor orflat-screen display (or mobile device screen). The display device 610may display the GUIs and/or output from sub-system components (orsoftware).

Examples of the computer system 600 include dedicated server computers,such as bladed servers, personal computers, laptop computers, notebookcomputers, palm top computers, network computers, mobile devices, or anyprocessor-controlled device capable of executing a web browser or othertype of application for interacting with the system.

Although only one computer system 600 is shown in detail, system 600 mayuse multiple computer systems or servers as necessary or desired tosupport the users and may also use back-up or redundant servers toprevent network downtime in the event of a failure of a particularserver. In addition, although computer system 600 is depicted withvarious components, one skilled in the art will appreciate that thesystem can contain additional or different components. In addition,although aspects of an implementation consistent with the above aredescribed as being stored in a memory, one skilled in the art willappreciate that these aspects can also be stored on or read from othertypes of computer program products or computer-readable media, such assecondary storage devices, including hard disks, floppy disks, orCD-ROM; or other forms of RAM or ROM. The computer-readable media mayinclude instructions for controlling the computer system 600, to performa particular method, such as methods described above.

The present disclosure is not to be limited in terms of the particularembodiments described in this application, which are intended asillustrations of various aspects. Many modifications and variations canbe made without departing from its spirit and scope, as may be apparent.Functionally equivalent methods and apparatuses within the scope of thedisclosure, in addition to those enumerated herein, may be apparent fromthe foregoing representative descriptions. Such modifications andvariations are intended to fall within the scope of the appendedrepresentative claims. The present disclosure is to be limited only bythe terms of the appended representative claims, along with the fullscope of equivalents to which such representative claims are entitled.It is also to be understood that the terminology used herein is for thepurpose of describing particular embodiments only, and is not intendedto be limiting.

1. A method comprising: receiving a first request for opening an accountat a server of a service provider, wherein the first request wasobtained from a user interface of a device of a user; responsive toreceiving the first request, transmitting, from the server to thedevice, a set of questions to be displayed in the user interface of thedevice; receiving, at the server, a response to the set of questions,the response including a username, a password, a reset phrase, and areset media file, wherein: the response was obtained using the userinterface of the device; and the user can access the account using theusername and the password; receiving, at the server, a second requestfor resetting the password, wherein the second request was obtained fromthe user interface of a second device; responsive to receiving thesecond request, transmitting, from the server to the second device, acommunication including the reset phrase and a plurality of media files,wherein: the communication is configured to be displayed on the userinterface of the second device; and the media files include a pluralityof related media files and the reset media file; receiving, at theserver from the second device, a selection of at least one of theplurality of media files, wherein the selection was obtained using theuser interface of the second device; and responsive to receiving theselection, determining whether the selection matches the reset mediafile, and if the selection matches the reset media file, transmitting atemporary password to the user such that the user can access the accountusing the username and the temporary password.
 2. The method of claim 1,wherein: the server includes a database of media files; the plurality ofrelated media files is chosen by the server; and the server chooses eachof the plurality of related media files based on a comparison of thereset media file and at least some of the media files stored in thedatabase.
 3. The method of claim 2, wherein the server chooses each ofthe plurality of related media files if the media files are within atolerance level of similarity of the reset media file.
 4. The method ofclaim 3, wherein the comparison of the reset media file and at leastsome of the media files stored in the database are based on an acousticfingerprint.
 5. The method of claim 3, wherein the comparison of thereset media file and at least some of the media files stored in thedatabase are based on a maximally stable extremal regions algorithm. 6.The method of claim 1, wherein at least one of the plurality of mediafiles is a photo.
 7. The method of claim 1, wherein at least one of theplurality of media files is a video file.
 8. The method of claim 1,wherein the response to the set of questions includes more than onemedia file.
 9. The method of claim 8, wherein the plurality of mediafiles in the communication include at least two of the plurality ofreset photos.
 10. The method of claim 9, wherein the selection matchesthe reset media file if all of the at least two of the plurality ofreset media files are identified in the selection.
 11. The method ofclaim 1, wherein the first device and the second device are the samedevice.
 12. The method of claim 1, wherein the transmitting a temporarypassword to the user includes at least one of emailing the temporarypassword to the user or transmitting a communication to the seconddevice such that the communication is displayable on the user interfaceof the second device.
 13. A method comprising: transmitting a firstrequest for opening an account to a server of a service provider,wherein the first request is entered into a user interface of a deviceof a user; displaying a set of questions received from the server in theuser interface of the device; transmitting, to the server, a response tothe set of questions, the response including a username, a password, areset phrase, and a reset media file, wherein: the response is enteredusing the user interface of the device; and the user can access theaccount using the username and the password; transmitting, from a seconddevice to the server, a second request for resetting the password,wherein the second request is entered from the user interface of thesecond device; receiving, at the second device from the server, acommunication including the reset phrase and a plurality of media files,wherein: the communication is displayed on the user interface of thesecond device; and the media files include a plurality of related mediafiles and the reset media file; transmitting, from the second device tothe server, a selection of at least one of the plurality of media files,wherein the selection is entered using the user interface of the seconddevice; and receiving a temporary password at the second device inresponse to a determination by the server that the selection matches thereset media file, wherein the user can access the account using theusername and the temporary password.
 14. The method of claim 13, whereinall of the plurality of media files are photos or all of the pluralityof media files are video files.
 15. The method of claim 13, wherein atleast one of the plurality of media files is a photo.
 16. The method ofclaim 13, wherein at least one of the plurality of media files is avideo file.
 17. The method of claim 13, wherein the response to the setof questions includes more than one media file.
 18. The method of claim17, wherein the plurality of media files in the communication include atleast two of the plurality of reset photos.
 19. The method of claim 18,wherein the selection matches the reset media file if all of the atleast two of the plurality of reset media files are identified in theselection.
 20. A method comprising: receiving, at a server from adevice, a request for resetting a password; responsive to receiving therequest, transmitting, from the server to the device, a communicationincluding a reset phrase and a plurality of media files, wherein: thecommunication is configured to be displayed on a user interface of thedevice; and the media files include a plurality of related media files,and at least one of the reset media file and a media file indicatingthat the reset media file is not displayed; receiving, at the serverfrom the device, a selection of at least one of the plurality of mediafiles, wherein the selection was obtained using the user interface ofthe device; and responsive to receiving the selection, determiningwhether the selection matches the reset media file, and if the selectionmatches the reset media file, transmitting a temporary password to theuser such that the user can access the account using the username andthe temporary password, wherein: the server includes a database of mediafiles; the plurality of related media files is chosen by the server; theserver chooses each of the plurality of related media files based on acomparison of the reset media file and at least some of the media filesstored in the database; and the server chooses each of the plurality ofrelated media files if the media files are within a tolerance level ofsimilarity of the reset media file.